Windows app stuck on "Finish Windows setup" — sandbox setup never triggers a real UAC prompt, "Retry" fails instantly

[joseluisjl4]

What version of the Codex App are you using (From “About Codex” dialog)?

Unknown — the app is blocked on the "Finish Windows setup" screen and I cannot reach the About dialog.

What subscription do you have?

Plus

What platform is your computer?

"$([Environment]::OSVersion | ForEach-Object VersionString) $(if ([Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" })"

What issue are you seeing?

On first launch the Windows app is stuck on the "Finish Windows setup" screen ("ChatGPT necesita un permiso por única vez para funcionar en tu computadora"). It always shows "La instalación de Windows no se completó", and clicking "Reintentar la configuración de Windows" fails instantly. No real Windows UAC prompt ever appears when clicking Retry — the UAC dialog shown on that screen is only an illustration, and no actual elevation request is triggered. The setup gate blocks before the app is usable at all.

What steps can reproduce the bug?

1. Install the ChatGPT/Codex desktop app from the Microsoft Store on Windows 11 Pro.
2. Launch the app.
3. It shows "Finish Windows setup" requesting a one-time permission.
4. Click "Reintentar la configuración de Windows" — it fails immediately with "La instalación de Windows no se completó". No real UAC prompt appears.

Already verified/attempted, none resolves it:

• CPU virtualization: enabled (confirmed in Task Manager)
• VirtualMachinePlatform and Containers-DisposableClientVM features: both enabled, rebooted
• Local Administrator account; "Run as administrator" → same error
• UAC at default level; AppInfo service running
• Clean reinstall from Microsoft Store → same error
• Reset %USERPROFILE%.codex → same error
• "Continuar con acceso limitado" also fails
• Added [windows] sandbox = "wsl" to config.toml → no effect (setup gate blocks before it's read)

Workaround: Codex CLI inside WSL2 works fine, which points to the native Windows sandbox setup step being the broken component. Looks related to issues #26737 and #26883.

What is the expected behavior?

The app should complete the one-time Windows setup and open normally.

Additional information

No response

[github-actions]

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• Windows setup fails before the UAC prompt, and both setup options are non-functional #32149
• cannot finish Windows setup to continue #32248
• Codex starts and wants more permissions. It hangs and doesn't allow me to move further. Codex is a bricked. #32255

Powered by Codex Action

[PyroClash]

I deleted my .codex/config.toml and restarted the app and it fixed it

[skydiver1118]

I am seeing the same issue on Windows 11 with a ChatGPT Pro account.

Symptoms:

• The app is stuck on Finish Windows setup.
• Clicking Try Windows setup again does not trigger a real Windows UAC prompt.
• The app reports that Windows setup did not finish.
• Continue with limited access does not provide a stable workaround; the app may briefly show the main Codex screen and then return to the same setup loop.

Troubleshooting already attempted without success:

• Reset the app and restarted Windows.
• Uninstalled and reinstalled the app multiple times, including a fresh reinstall again today.
• Confirmed that %USERPROFILE%\.codex\config.toml contained [windows] sandbox = "unelevated".
• Tried the setup button repeatedly; no actual UAC dialog appears.

The same behavior persists after today’s reinstall. This appears to be the same native Windows sandbox/onboarding failure described in this issue, not a one-time installation problem.

[skydiver1118]

Additional detail from another affected Windows user: after a fresh reinstall, %USERPROFILE%\.codex\config.toml does not exist, so the workaround of deleting or renaming config.toml is not applicable. The app still loops on “Finish Windows setup”; clicking Retry does not trigger a real UAC prompt.

[skydiver1118]

Additional reproduction detail from my Windows 11 / ChatGPT Pro installation:

• I renamed %USERPROFILE%\.codex\config.toml so the app would start without the existing user configuration.
• On the next launch, the app temporarily passed the Finish Windows setup gate and displayed the main ChatGPT Work/Codex home screen.
• It then automatically attempted to download/install a ChatGPT update.
• The update failed with the dialog: “Unable to install the ChatGPT update. Try checking for updates again.”
• This machine previously also returned Microsoft Store / winget source connectivity errors (WinHttpSendRequest: 12029, 0x80072efd).

So disabling config.toml changes the failure mode but does not yet produce a stable working installation. Screenshot available if needed.

[zengxm1979]

I found another confirmed root cause that can produce this exact desktop symptom.

The ChatGPT/Codex Windows app was stuck on Finish Windows setup and clicking Retry/UAC did not recover it. Repair, restart, running as administrator, and changing [windows].sandbox did not help.

The actual problem was a malformed %USERPROFILE%\.codex\config.toml. Two project table headers containing non-ASCII/Chinese folder names were missing the closing single quote, for example:

# Invalid
[projects.'D:\codeX\Example项目]

# Valid
[projects.'D:\codeX\Example项目']

The desktop app surfaced this as a Windows setup failure instead of reporting the TOML parse error.

A safe diagnostic was:

npx @openai/codex resume

The CLI reported the exact location:

Error loading config.toml:
...config.toml:87:31: unclosed table, expected `] `

After backing up config.toml and correcting only the malformed project table headers, the Windows desktop app opened normally again with all projects intact.

Suggested troubleshooting before reinstalling or resetting data:

1. Back up %USERPROFILE%\.codex\config.toml.
2. Run npx @openai/codex resume (or another CLI command) to force config parsing and obtain an exact line number.
3. Check every [projects.'...'] header, especially paths with non-ASCII characters, for a missing closing quote/bracket.
4. Fix only the malformed lines; do not rename/delete the whole .codex directory.

It would be helpful if Desktop displayed the underlying config.toml parse error instead of routing users to the Windows sandbox setup screen.

[heinerborle]

I've discovered another critical root cause for the "Finish Windows setup" hang (where the UAC prompt never triggers) that is related to authentication rather than Windows privileges or system features.

The Underlying Issue

If your user session has expired or the OAuth refresh token has been revoked, the desktop app fails to fetch the cloud configuration bundle (cloudConfigBundle) during startup:

failed to load configuration: Your access token could not be refreshed because your refresh token was revoked. Please log out and sign in again.

This causes the backend windowsSandbox/setupStart call to fail with a 401 Unauthorized / Auth error. Instead of displaying a prompt to log out and log in again, the Desktop UI incorrectly routes this error to the "Finish Windows setup" gate, making it appear as a permissions/sandbox setup failure.

The Fix / Workaround

To break the loop and force the app to show the login screen:

1. Close the ChatGPT/Codex Desktop application completely.
2. Open File Explorer and navigate to your user profile directory: %USERPROFILE%\.codex (usually C:\Users\<username>\.codex).
3. Locate the file named auth.json.
4. Rename auth.json to auth.json.bak (or delete it).
5. Relaunch the ChatGPT/Codex app.

The app will now detect that no login session exists, skip the sandboxing gate, and successfully route you to the Sign In screen. Once you log back in, a fresh OAuth session will be established, and the app will open normally.